CVSS: 4.0EPSS: 0%CPEs: 80EXPL: 0CVE-2017-1756
https://notcve.org/view.php?id=CVE-2017-1756
IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 135856. La versión 8.6 de IBM Business Process Manager permite que las páginas web se almacenen localmente, lo que permite que sean leídas por otro usuario en el sistema. IBM X-Force ID: 135856. • http://www.ibm.com/support/docview.wss?uid=swg22010796 http://www.securityfocus.com/bid/103589 https://exchange.xforce.ibmcloud.com/vulnerabilities/135856 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 10EXPL: 0CVE-2017-1494
https://notcve.org/view.php?id=CVE-2017-1494
IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128692. IBM Business Process Manager 8.5 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. • http://www.ibm.com/support/docview.wss?uid=swg22008673 http://www.securityfocus.com/bid/102218 http://www.securitytracker.com/id/1040355 https://exchange.xforce.ibmcloud.com/vulnerabilities/128692 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 72EXPL: 0CVE-2017-1527
https://notcve.org/view.php?id=CVE-2017-1527
IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 130156. Las versiones 7.5, 8.0 y 8.5 de IBM Business Process Manager son vulnerables a ataques de tipo XML External Entity Injection (XXE) al procesar datos XML. Un atacante remoto podría explotar esta vulnerabilidad para exponer información sensible o consumir recursos de la memoria. • http://www.ibm.com/support/docview.wss?uid=swg22007346 http://www.securityfocus.com/bid/100959 https://exchange.xforce.ibmcloud.com/vulnerabilities/130156 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.4EPSS: 0%CPEs: 8EXPL: 0CVE-2017-1425
https://notcve.org/view.php?id=CVE-2017-1425
IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 127478. IBM Business Process Manager en sus versiones 8.0.1.1 y 8.5.7 es vulnerable a Cross-Site Scripting. Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades planeadas. • http://www.ibm.com/support/docview.wss?uid=swg22006265 http://www.securityfocus.com/bid/100961 https://exchange.xforce.ibmcloud.com/vulnerabilities/127478 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 72EXPL: 0CVE-2017-1539
https://notcve.org/view.php?id=CVE-2017-1539
IBM Business Process Manager 7.5, 8.0, and 8.5 is vulnerable to privilege escalation by not properly distinguishing internal group memberships from user registry group memberships. By manipulating LDAP group membership an attack might gain privileged access. IBM X-Force ID: 130807. Las versiones 7.5, 8.0 y 8.5 de IBM Business Process Manager son vulnerables a un escalado de privilegios debido a que no distinguen entre la pertenencia a un grupo interno o la pertenencia a un grupo de usuarios registrados. Mediante la manipulación de una pertenencia a un grupo LDAP, un atacante podría conseguir acceso con privilegios. • http://www.ibm.com/support/docview.wss?uid=swg22007451 http://www.securityfocus.com/bid/100967 https://exchange.xforce.ibmcloud.com/vulnerabilities/130807 •